Privacy Notice Covid-19

COVID-19

COVID-19 Local Outbreak Control Programme

How we will use your information

As the COVID-19 pandemic continues and restrictions set by the government change regularly, we have set up a programme to manage outbreaks of the disease that may happen in particular parts of the borough. This follows the Government’s recovery strategy which requires the monitoring of the pandemic accurately, as well as quickly detecting and tackling outbreaks.

This will enable us to:

  • understand the spread of COVID-19 and the risks to public health, trends in COVID-19 and such risks, and control and prevent the spread of COVID-19 and such risks
  • identify and understand information about patients with COVID-19 and collect information about services in relation to testing and contact tracing for COVID-19
  • monitor and manage the response to COVID-19 by health and social care bodies in relation to testing, contact tracing and effective management of outbreaks of COVID-19
  • provide appropriate and timely support to people who require assistance to isolate when requested to do so
  • undertake research and planning in relation to testing, contact tracing and outbreak management for COVID-19

We are processing personal data that may include:

  • name, address, date of birth, postcode, language, ethnic group, sex, workplace / school / care home address, telephone number, email address, employment type and details, key worker status, work address
  • test date, test result, where test conducted (laboratory, mobile testing station, home test), COVID-19 symptoms, deceased / alive
  • household members personal details (as above first bullet point)
  • visitor personal details (as above first bullet point)
  • places visited within the past 48 hours and postcode for these locations
  • whether contact with household members or visitors has been direct or indirect

We will obtain information from:

  • you: when we contact you because you tested positive for COVID-19, or because you were identified as having had contact with someone who tested positive for COVID-19
  • Public Health England: they are providing us with a list of people who have tested positive from the NHS Track and Trace system
  • The NHS including NHS England, Local NHS Foundation Trusts and the Rotherham NHS Clinical Commissioning Group for information about local outbreaks of COVID-19 and to provide additional support with the response
  • within the Council: we hold several datasets with personal information eg Adult and Children Social Care records, shielded/vulnerable list of people identified during phase 1 of the pandemic and educational settings such as schools and colleges

Data Matching

We are carrying out data matching for combining, comparing or matching personal data obtained from multiple sources. We are doing this to complete any gaps in information from any one source so that we can accurately identify individuals to support them and provide the necessary understanding of disease trends.

Lawful Basis for Processing

Under data protection law, we must have a lawful basis for processing personal data:

  • Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Section 8(c) of the Data Protection Act 2018 sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law. 

Under ‘COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020, the Council has been given legal notice by the Secretary of State for Health and Social Care to support the processing and sharing of information to help the COVID-19 response.

The processing of special categories of personal data, which includes data concerning a person’s health are prohibited unless specific further conditions can be met. These further relevant conditions are below:

  • Article 9.2.(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy
  • Schedule 1, Part 1(3) of the Data Protection Act 2018 – processing is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law i.e. Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002

Who we will share your information with

Your personal data will be shared with:  

  • Council officers in Public and Environmental Health, Adult and Children’s Social Care and other internal services managing the response to the pandemic
  • Third party organisations such as the NHS that are directly involved in treating and supporting people  
  • Volunteer organisations to support individual requests for assistance

Information Security

We recognise that the information we are processing is sensitive and we will store and process your information securely. We will ensure access to the data is managed, auditable and restricted to those needing to process the data.

How long we will keep your information

Information from Public Health England will be kept only for the duration of the contract we have with them for sharing personal data or until such time as the ‘COVID-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002’ from the Secretary of State for Health and Social Care to Local Authorities in England dated 20 March 2020 is extended. Otherwise we will keep the information for the duration of the pandemic, taking into account government advice and our business needs.

Rotherham Libraries

How we will use your information

This Privacy Notice explains how Rotherham Metropolitan Borough Council (as Data Controllers) will collect, use and protect personal data specifically with regards to the Libraries Services and the coronavirus pandemic.

Personal information is shared across organisations for the purpose of responding to the critical public health crisis in respect of the COVID-19 pandemic. The personal data in respect of this service is processed for three purposes, these are to:

  • Test – the testing of key health and social care workers, other critical workers, members of their household and citizens at Community Testing Units, Mobile Testing Units and/or at home
  • Trace – using results of confirmed cases to contact individuals and identify details
  • Protect – enhancing the public health surveillance and response system to enable the prevention of infection and the tracking of the virus as restrictions are eased. We will make daily contacts with the Primary and Secondary Contacts to monitor the wellbeing and provide advice and clinical recommendations

Lawful Basis for Processing

Most of the personal information we process is provided to us directly by you, under the General Data Protection Regulation (GDPR). The lawful bases we rely on for using your personal information are:

  • GDPR Article 6 (e) we need it to perform a public task. 

When we collect data about your health, we also rely on the following lawful basis:

  • GDPR Article 9 (2) (h) Provision of preventative or occupational medicine, health or social care or treatment, or the management of health or social care systems
  • GDPR Article 9 (2) (i) Public Health
  • Data Protection Act 2018 – Schedule 1, Part 1, (2) (2) (f) – Health and social care purposes
  • Data Protection Act 2018 – Schedule 1, Part 1, (3) (a) – necessary for reasons of public interest in the area of public health

Information Collected

  • Name
  • Address
  • Email address
  • Telephone number

Who we will share your information with

  • Council officers in Public and Environmental Health, Adult and Children’s Social Care and other internal services managing the response to the pandemic
  • Third party organisations such as the NHS that are directly involved in treating and supporting people  

How long we will keep your information

Information will be stored securely for 21 days and then destroyed securely.

For more information regarding your data rights and how the Council will process your information please view the full Privacy Notice on our website at www.rotherham.gov.uk.

If you are unhappy about how your data is used you can complain directly to the Council directly to the Council’s Data Protection Officer at DPO@rotherham.gov.uk.